BFsix_[unknowncheats[.]me]_[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
BFsix_[unknowncheats.me]_.exe
Size 20KB
Sample260809-bs4saagb93
SHA256 821bad6ebf683c8948af31af1547d23f3b7ca15e48da763abad4809122f5a3ac
MD5 5a37ac826a2d9789be6aa727494f5bd3
SHA1 378f1246295b3b19fca79b654d14f2ab75a23ce0
SHA512 e520f3ca6936f5599c78fe781c0de99c9ab3b375ab4590f3a508a425412c72defda6bb4bf5ca7938586e61980bd1bc13668d1979d4e8752bb69d6ea344a9d73f
SSDEEP 384:F3gyJLPeed/v7gxCpiC1BAcZEY9ZItfQnn41/NAyEgWpAs1Fdbnn4gu33qK:7tpxvItfg4AyEdznd7nu33qK
TLSH
T1E5923B06E79609FAD6B6923DC1A3225EE2B27D051722E3CF1350837E1F726D0AC3A650
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BFsix_[unknowncheats.me]_.exe

File Explorer

BFsix_[unknowncheats.me]_.exe

.exe 20KB

BFsix_[unknowncheats.me]_.exe

IMPHASH 43290b12d246f2abfa5fad86d3e4c1a2
SHA256 821bad6ebf683c8948af31af1547d23f3b7ca15e48da763abad4809122f5a3ac
MD5 5a37ac826a2d9789be6aa727494f5bd3
SHA1 378f1246295b3b19fca79b654d14f2ab75a23ce0
SHA512 e520f3ca6936f5599c78fe781c0de99c9ab3b375ab4590f3a508a425412c72defda6bb4bf5ca7938586e61980bd1bc13668d1979d4e8752bb69d6ea344a9d73f
SSDEEP 384:F3gyJLPeed/v7gxCpiC1BAcZEY9ZItfQnn41/NAyEgWpAs1Fdbnn4gu33qK:7tpxvItfg4AyEdznd7nu33qK
TLSH
T1E5923B06E79609FAD6B6923DC1A3225EE2B27D051722E3CF1350837E1F726D0AC3A650
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Lucid\Downloads\LucidTb\BFsix\x64\Release\BFsix.pdb

kernel32

GetConsoleWindow Sleep GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW

user32

GetWindowTextW EnumWindows GetAsyncKeyState IsWindow ShowWindow keybd_event SetWindowPos GetWindowTextLengthW

msvcp140

?good@ios_base@std@@QEBA_NXZ ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z _Query_perf_frequency ?uncaught_exception@std@@YA_NXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?wcin@std@@3V?$basic_istream@_WU?$char_traits@_W@std@@@1@A ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset __std_terminate __C_specific_handler memcpy _CxxThrowException __current_exception __current_exception_context __std_exception_copy __std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit _initialize_onexit_table _c_exit _cexit __p___argv __p___argc system _exit exit _initterm_e _initterm _get_initial_narrow_environment _configure_narrow_argv terminate _set_app_type _seh_filter_exe _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo_noreturn _initialize_narrow_environment

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale